Skip to content

Commit

Permalink
Fix bounds check issue in PDF parser
Browse files Browse the repository at this point in the history
The bytes_remaining variable may be set negative by mistake, when really
we just want to decrement it.
This issue may result in a 1-byte over read but does not cause any
crash.

We determined that this issue is not a vulnerability.

Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58475
  • Loading branch information
micahsnyder committed Aug 10, 2023
1 parent c961189 commit ba49cbf
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion libclamav/pdf.c
Original file line number Diff line number Diff line change
Expand Up @@ -928,7 +928,7 @@ static size_t find_length(struct pdf_struct *pdf, struct pdf_obj *obj, const cha

/* Step the index into the "/Length" string. */
index++;
bytes_remaining -= index - obj_start;
bytes_remaining--;

/* Find the start of the next direct or indirect object.
* pdf_nextobject() assumes we started searching from within a previous object */
Expand Down

0 comments on commit ba49cbf

Please sign in to comment.